Skip to content

Commit da9bfd0

Browse files
veritasr3xw0rk3rterrancedejesus
authored
MITRE ATT&CK Sub-Technique Update - Solves Issue #5279 (#5280)
* Resolves Issue #5279 * Corrected the "updated_date" value * Put the technique and sub-technique in the correct location --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
1 parent 32fb003 commit da9bfd0

File tree

1 file changed

+10
-2
lines changed

1 file changed

+10
-2
lines changed

rules/windows/command_and_control_common_webservices.toml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/04"
33
integration = ["endpoint", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/09/04"
5+
updated_date = "2025/11/04"
66

77
[transform]
88
[[transform.investigate]]
@@ -344,14 +344,22 @@ id = "T1568.002"
344344
name = "Domain Generation Algorithms"
345345
reference = "https://attack.mitre.org/techniques/T1568/002/"
346346

347-
347+
[[rule.threat.technique]]
348+
id = "T1090"
349+
name = "Proxy"
350+
reference = "https://attack.mitre.org/techniques/T1090/"
351+
[[rule.threat.technique.subtechnique]]
352+
id = "T1090.002"
353+
name = "External Proxy"
354+
reference = "https://attack.mitre.org/techniques/T1090/002/"
348355

349356
[rule.threat.tactic]
350357
id = "TA0011"
351358
name = "Command and Control"
352359
reference = "https://attack.mitre.org/tactics/TA0011/"
353360
[[rule.threat]]
354361
framework = "MITRE ATT&CK"
362+
355363
[[rule.threat.technique]]
356364
id = "T1567"
357365
name = "Exfiltration Over Web Service"

0 commit comments

Comments
 (0)